{"id":"CVE-2026-43847","kind":"vulnerability","aliases":["CVE-2026-43847"],"related":[],"title":"Proprietary protocol lets attackers brute force administrator password without limits","description":"A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.","summary":"Advantech ADAM-3600 EdgeLink RTU: the proprietary protocol has no limit on administrator password attempts, so a network attacker can brute force it, even with SafeEnhancement enabled. Fixed by a lockout after repeated failures.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ADAM-3600","fixed":["2.8.5.0"],"affected":"< 2.8.5.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["adam-3600","administrator-login","advantech","brute-force","edgelink","ics","infrastructure","ot","proprietary-protocol"],"not_affected_if":["firmware-2.8.5.0-or-later","protocol-not-network-reachable"],"how_to_check":"Check ADAM-3600 firmware version in the device web UI or EdgeLink; versions below 2.8.5.0 are affected. Check whether the device's proprietary protocol ports (6001/7001 are named in a sibling CVE-2026-43844) are reachable from untrusted networks.","fix":"Upgrade ADAM-3600 firmware to 2.8.5.0 or later (per CVE record; Advantech's fix adds a lockout: after 5 consecutive failed attempts, a 5-minute wait). Until then, restrict network access to the proprietary protocol ports to trusted admin hosts and use a long random admin password.","status":"open","published_at":"2026-10-20T09:17:11+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:04:14+00:00","updated_at":"2026-10-25T03:34:57+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-10-25T03:04:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Proprietary protocol lets attackers brute force administrator password without limits","impact":"high","summary":"A flaw in a proprietary protocol lets an attacker guess the administrator password with no restriction on attempts. The SafeEnhancement feature does not stop this brute-force attack.","category":"infrastructure","nicknames":[],"who_cares":["administrator-login","proprietary-protocol"],"confidence":0.4,"needs_auth":"no","worst_case":"Attacker guesses admin password and gains administrator access to the device","analyst_note":"Identify the affected vendor and product from the NVD entry and find the vendor advisory for the fixed version and the SafeEnhancement setting.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000493,"input_tokens":3266,"output_tokens":333,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected vendor and product from the NVD entry and find the vendor advisory for the fixed version and the SafeEnhancement setting.","search":"'-2026':12A,15A '-3600':18A,20B,37B '-43847':13A,16A 'adam':17A,19B,36B 'administr':7A,22B,47B,83C 'administrator-login':21B 'advantech':24B,35B 'allow':76C 'attack':4A,53B,78C 'attempt':49B 'brute':5A,26B,55B,80C 'brute-forc':25B 'could':75C 'cve':11A,14A 'edgelink':28B,38B 'enabl':61B,93C 'even':58B,87C 'failur':68B 'featur':91C 'fix':62B 'forc':6A,27B,56B,81C 'ic':29B 'infrastructur':30B 'let':3A 'limit':10A,45B 'lockout':65B 'login':23B 'network':52B 'ot':31B 'password':8A,48B,84C 'proprietari':1A,33B,41B,73C 'proprietary-protocol':32B 'protocol':2A,34B,42B,74C 'repeat':67B 'restrict':86C 'rtu':39B 'safeenhanc':60B,90C 'vulner':70C 'without':9A,85C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Advantech ADAM-3600 EdgeLink remote terminal units on firmware older than 2.8.5.0 where the proprietary management protocol is reachable over the network. Typical systems are industrial data acquisition and remote monitoring sites. Teams without ADAM-3600 devices, or with the protocol reachable only from a trusted admin network, can deprioritize it, though it is one of about 30 CVEs fixed in the same release.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T09:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-43847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43847","severity":null,"published_at":"2026-10-20T09:17:11+00:00","modified_at":"2026-10-20T19:30:59+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-43847:748","url":null,"severity":null,"published_at":"2026-10-25T03:34:57+00:00","modified_at":"2026-10-25T03:34:57+00:00","first_seen_at":"2026-10-25T03:34:57+00:00","fetched_at":"2026-10-25T03:34:57+00:00","note":"Advantech ADAM-3600 (ACIRT-261001, item 19, NN-2026-0008); vendor PDF read: fix adds lockout (5 failed attempts -> 5 min wait). Affected 'prior to 2.8.5.0' comes from the CVE record/NVD, not stated in the vendor PDF excerpt I read, so nothing marked verified. No exploitation or PoC found; no x search done (low-profile OT CVE)."}],"documents":[{"id":1917,"url":"https://advcloudfiles.advantech.com/cms/de8e2d94-10ab-470e-ac6f-d2e5434f4ec4/Security%20Advisory%20PDF%20File/SECURITY-ADVISORY----ADAM-3600.pdf","title":"Advantech: Vulnerabilities Identified in ADAM-3600 (ACIRT-261001)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1913,"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-149","title":"CSA Singapore AL-2026-149: Advantech ADAM-3600 EdgeLink multiple vulnerabilities","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}